Update dependencies to address security advisories

[sean-mcmanus]

Summary

Updates transitive dependencies to patched releases:

• ip-address to 10.3.1 and undici to 6.28.0 for the GitHub Actions package
• postcss to 8.5.25 for the main extension
• undici to 7.29.0 for the Extension Pack

The remaining fast-uri@3.1.4 advisory is not addressed because its patched release, 3.1.5, is not currently available from the repository's configured npm registry.

Validation

• The GitHub Actions package reports zero audit vulnerabilities.
• The main extension passes a frozen Yarn install and TypeScript compilation.
• The main extension and Extension Pack audits report only the unavailable fast-uri@3.1.5 fix.

This PR was investigated and created by Copilot with GPT-5.6 Sol (in VS Code). Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

Pull request overview

This PR updates dependency lockfiles and Yarn resolutions to pull in patched transitive dependency versions, addressing reported security advisories across the main extension, the Extension Pack, and the GitHub Actions package.

Changes:

• Bump undici in the Extension Pack lockfile to 7.29.0.
• Update the main extension’s PostCSS resolution/lockfile to 8.5.25 (with a ^8.5.23 minimum via resolutions).
• Bump .github/actions transitive dependencies (ip-address to 10.3.1, undici to 6.28.0) in its lockfile.

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated no comments.

File	Description
ExtensionPack/package-lock.json	Updates locked undici tarball/version to a newer patched release for the Extension Pack.
Extension/yarn.lock	Locks PostCSS to 8.5.25 and updates the undici descriptor to ^7.29.0 for the main extension install graph.
Extension/package.json	Raises the minimum PostCSS resolution to ^8.5.23 to avoid vulnerable versions while keeping installs flexible.
.github/actions/package-lock.json	Updates locked ip-address and undici versions to patched releases for the GitHub Actions package.

Files not reviewed (2)

• .github/actions/package-lock.json: Generated file
• ExtensionPack/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.